Italian DPA fines La Patria S.p.A. EUR 39,000 over employee data access failures

What happened

• The Italian Data Protection Authority investigated La Patria S.p.A. after a former employee complained about denied access to disciplinary documents and lack of clear information on GPS tracking.
• The regulator found violations of GDPR Articles 12, 13 and 15, imposing a total fine of EUR 39,000 split between access‑right failures (EUR 22,000) and information‑provision failures (EUR 17,000).
• The company had already begun remedial actions, so no further corrective measures were ordered.

Why it matters

Employers handling employee monitoring must treat access requests as GDPR rights and supply precise notices on geolocation processing, or risk enforcement actions.

Business impact

Failure to comply can lead to monetary penalties and reputational damage, prompting firms to audit privacy notices and access‑request workflows.

What to check

1. 1

   Update employee privacy noticesHigh priority

   Remove inaccurate references to special categories and clearly describe GPS tracking purposes.

2. 2

   Implement a formal access‑request procedureHigh priority

   Respond to employee requests within GDPR timelines and provide reasons if a request is denied.

3. 3

   Document geolocation data processingMedium priority

   Ensure employees receive detailed information about how vehicle GPS data is collected and used.